The vulnerability allows an unauthenticated attacker to request the download.php component of the NativeChurch WordPress theme and supply a traversal string in the file parameter. By manipulating this parameter, the attacker can read restricted files such as wp-config.php, potentially exposing database credentials and other sensitive information. The weakness is a classic path traversal flaw (CWE-22) that can be executed with a simple HTTP GET request, providing immediate confidentiality compromise with no additional privileges required.

The affected product is the NativeChurch theme for WordPress, produced by imithemes. Versions older than 1.6.2 contain the flaw. No other vendors or product versions are listed.

The CVSS score is 8.7, indicating high severity. EPSS data is not available, so precise exploitation probability cannot be quantified, but the vulnerability is actively observed and listed by security groups. It is not in the CISA KEV catalog. The attack vector is remote and requires only a crafted HTTP request to download.php, with no authentication or additional access needed. The impact is immediate and requires notification and patching.